schema

type Acl struct {
	ID               string                  `json:"id"`
	Default          bool                    `json:"default"`
	MetaData         string                  `json:"meta_data"`
	Name             string                  `json:"name"`
	NetworkID        NetworkID               `json:"network_id"`
	RuleType         AclPolicyType           `json:"policy_type"`
	Src              []AclPolicyTag          `json:"src_type"`
	Dst              []AclPolicyTag          `json:"dst_type"`
	Proto            Protocol                `json:"protocol"`
	ServiceType      string                  `json:"type"`
	Port             []string                `json:"ports"`
	AllowedDirection AllowedTrafficDirection `json:"allowed_traffic_direction"`
	Enabled          bool                    `json:"enabled"`
	CreatedBy        string                  `json:"created_by"`
	CreatedAt        time.Time               `json:"created_at"`
}

type AclGroupType string

type AclPolicyTag struct {
	ID    AclGroupType `json:"id"`
	Name  string       `json:"name"`
	Value string       `json:"value"`
}

type AclPolicyType string

type AclRecord struct {
	Key       string `gorm:"primaryKey"`
	TenantID  string `gorm:"default:'';index"`
	NetworkID string
	Value     datatypes.JSONType[Acl]
}

type Action string

type AddrPort struct {
	netip.AddrPort
}

type AllowedTrafficDirection int

type Attribute string

type AuthType string

type CacheRecord struct {
	Key   string `gorm:"primaryKey"`
	Value datatypes.JSONType[CacheValue]
}

type CacheValue struct {
	Scope      scope.Scope `json:"scope"`
	ScopeID    string      `json:"scope_id"`
	Network    string      `json:"network,omitempty"`
	Value      string      `json:"value"`
	Host       Host        `json:"host"`
	Pass       string      `json:"pass,omitempty"`
	User       string      `json:"user,omitempty"`
	ALL        bool        `json:"all,omitempty"`
	Expiration time.Time   `json:"expiration"`
}

type DNSEntry struct {
	Type     DNSEntryType `json:"type"`
	Address  string       `json:"address" validate:"omitempty,ip"`
	Address6 string       `json:"address6" validate:"omitempty,ip"`
	Name     string       `json:"name" validate:"required,name_unique,min=1,max=192,whitespace"`
	Network  string       `json:"network" validate:"network_exists"`
}

type DNSEntryType string

type DNSRecord struct {
	Key       string `gorm:"primaryKey"`
	TenantID  string `gorm:"default:''"`
	NetworkID string
	Value     datatypes.JSONType[DNSEntry]
}

type DeviceEDRState struct {
	HostID         string         `gorm:"primaryKey;column:host_id" json:"host_id"`
	Provider       string         `gorm:"primaryKey;column:provider" json:"provider"`
	TenantID       string         `gorm:"default:'';index" json:"tenant_id"`
	EDRDeviceID    string         `gorm:"column:edr_device_id" json:"edr_device_id"`
	MatchedBy      string         `gorm:"column:matched_by" json:"matched_by"`
	AgentInstalled bool           `gorm:"column:agent_installed" json:"agent_installed"`
	AgentHealthy   bool           `gorm:"column:agent_healthy" json:"agent_healthy"`
	RiskLevel      string         `gorm:"column:risk_level" json:"risk_level"`
	ThreatCount    int            `gorm:"column:threat_count" json:"threat_count"`
	ActiveThreats  bool           `gorm:"column:active_threats" json:"active_threats"`
	Isolated       bool           `gorm:"column:isolated" json:"isolated"`
	Contained      bool           `gorm:"column:contained" json:"contained"`
	LastSeenAt     time.Time      `gorm:"column:last_seen_at" json:"last_seen_at"`
	LastSyncedAt   time.Time      `gorm:"column:last_synced_at" json:"last_synced_at"`
	LastError      string         `gorm:"column:last_error" json:"last_error,omitempty"`
	RawVendorData  datatypes.JSON `gorm:"column:raw_vendor_data" json:"raw_vendor_data,omitempty"`
}

type DeviceMDMState struct {
	HostID       string    `gorm:"primaryKey;column:host_id" json:"host_id"`
	Provider     string    `gorm:"primaryKey;column:provider" json:"provider"`
	TenantID     string    `gorm:"default:'';index" json:"tenant_id"`
	MDMDeviceID  string    `gorm:"column:mdm_device_id" json:"mdm_device_id"`
	Enrolled     bool      `gorm:"column:enrolled" json:"enrolled"`
	Compliant    bool      `gorm:"column:compliant" json:"compliant"`
	MatchedBy    string    `gorm:"column:matched_by" json:"matched_by"`
	LastSyncedAt time.Time `gorm:"column:last_synced_at" json:"last_synced_at"`
	LastSeenAt   time.Time `gorm:"column:last_seen_at" json:"last_seen_at"`
	// LastError holds a stable lookup failure code (e.g. device_not_registered_in_entra).
	LastError string `gorm:"column:last_error" json:"last_error,omitempty"`
}

type Egress struct {
	ID           string            `gorm:"primaryKey" json:"id"`
	TenantID     string            `gorm:"default:'';index" json:"tenant_id"`
	Name         string            `gorm:"name" json:"name"`
	Network      string            `gorm:"network" json:"network"`
	Description  string            `gorm:"description" json:"description"`
	Type         EgressType        `gorm:"column:egress_type;default:cidr;index" json:"type"`
	Nodes        datatypes.JSONMap `gorm:"nodes" json:"nodes"`
	Tags         datatypes.JSONMap `gorm:"tags" json:"tags"`
	Range        string            `gorm:"range" json:"range"`
	Mode         EgressNATMode     `gorm:"mode;default:direct_nat" json:"mode"`
	VirtualRange string            `gorm:"virtual_range" json:"virtual_range"`
	// Domains is the user-configured hostname list (exact or *.suffix).
	Domains datatypes.JSONSlice[string] `gorm:"domains" json:"domains"`
	// DomainAnsByDomain maps each configured domain to its resolved CIDRs.
	DomainAnsByDomain datatypes.JSONMap `gorm:"domain_ans_by_domain" json:"domain_ans_by_domain"`
	Nat               bool              `gorm:"nat" json:"nat"`
	// PresetID is the catalog id when this egress was created from a preset (empty if custom).
	PresetID  string    `gorm:"preset_id" json:"preset_id"`
	Status    bool      `gorm:"status" json:"status"`
	CreatedBy string    `gorm:"created_by" json:"created_by"`
	CreatedAt time.Time `gorm:"created_at" json:"created_at"`
	UpdatedAt time.Time `gorm:"updated_at" json:"updated_at"`
}

type EgressNATMode string

type EgressType string

type EnrollmentKey struct {
	ID                string                      `gorm:"primaryKey" json:"id"`
	TenantID          string                      `gorm:"default:'';index" json:"tenant_id"`
	Name              string                      `json:"name"`
	Value             string                      `gorm:"uniqueIndex" json:"value"`
	Token             string                      `json:"token"`
	Default           bool                        `json:"default"`
	Unlimited         bool                        `json:"unlimited"`
	UsesRemaining     int                         `json:"uses_remaining"`
	Expiration        time.Time                   `json:"expiration"`
	Networks          datatypes.JSONSlice[string] `json:"networks"`
	Tags              datatypes.JSONSlice[string] `json:"tags"`
	GatewayID         *string                     `json:"gateway_id"`
	AutoEgress        bool                        `json:"auto_egress"`
	AutoAssignGateway bool                        `json:"auto_assign_gateway"`
	Type              EnrollmentKeyType           `json:"type"`
	CreatedBy         string                      `json:"created_by"`
	CreatedAt         time.Time                   `json:"created_at"`
	UpdatedAt         time.Time                   `json:"updated_at"`
}

type EnrollmentKeyType int

type Event struct {
	ID          string         `gorm:"primaryKey" json:"id"`
	TenantID    string         `gorm:"default:'';index" json:"tenant_id"`
	Action      Action         `gorm:"action" json:"action"`
	Source      datatypes.JSON `gorm:"source" json:"source"`
	Origin      Origin         `gorm:"origin" json:"origin"`
	Target      datatypes.JSON `gorm:"target" json:"target"`
	NetworkID   NetworkID      `gorm:"network_id" json:"network_id"`
	TriggeredBy string         `gorm:"triggered_by" json:"triggered_by"`
	Diff        datatypes.JSON `gorm:"diff" json:"diff"`
	TimeStamp   time.Time      `gorm:"time_stamp" json:"time_stamp"`
}

type ExtClient struct {
	ClientID               string   `json:"clientid" bson:"clientid"`
	PrivateKey             string   `json:"privatekey" bson:"privatekey"`
	PublicKey              string   `json:"publickey" bson:"publickey"`
	Network                string   `json:"network" bson:"network"`
	DNS                    string   `json:"dns" bson:"dns"`
	Address                string   `json:"address" bson:"address"`
	Address6               string   `json:"address6" bson:"address6"`
	ExtraAllowedIPs        []string `json:"extraallowedips" bson:"extraallowedips"`
	AllowedIPs             []string `json:"allowed_ips"`
	IngressGatewayID       string   `json:"ingressgatewayid" bson:"ingressgatewayid"`
	IngressGatewayEndpoint string   `json:"ingressgatewayendpoint" bson:"ingressgatewayendpoint"`
	// SelectedInternetEgressID is the internet egress this config file uses for full-tunnel exit (empty = none).
	SelectedInternetEgressID          string              `json:"selected_internet_egress_id" bson:"selected_internet_egress_id"`
	LastModified                      int64               `json:"lastmodified" bson:"lastmodified" swaggertype:"primitive,integer" format:"int64"`
	Enabled                           bool                `json:"enabled" bson:"enabled"`
	OwnerID                           string              `json:"ownerid" bson:"ownerid"`
	DeniedACLs                        map[string]struct{} `json:"deniednodeacls" bson:"acls,omitempty"`
	RemoteAccessClientID              string              `json:"remote_access_client_id"`
	PostUp                            string              `json:"postup" bson:"postup"`
	PostDown                          string              `json:"postdown" bson:"postdown"`
	Tags                              map[TagID]struct{}  `json:"tags"`
	OS                                string              `json:"os"`
	OSFamily                          string              `json:"os_family" yaml:"os_family"`
	OSVersion                         string              `json:"os_version" yaml:"os_version"`
	KernelVersion                     string              `json:"kernel_version" yaml:"kernel_version"`
	ClientVersion                     string              `json:"client_version"`
	DeviceID                          string              `json:"device_id"`
	DeviceName                        string              `json:"device_name"`
	PublicEndpoint                    string              `json:"public_endpoint"`
	Country                           string              `json:"country"`
	Location                          string              `json:"location"`
	PostureChecksViolations           []Violation         `json:"posture_check_violations"`
	PostureCheckVolationSeverityLevel Severity            `json:"posture_check_violation_severity_level"`
	LastEvaluatedAt                   time.Time           `json:"last_evaluated_at"`
	JITExpiresAt                      *time.Time          `json:"jit_expires_at,omitempty" bson:"jit_expires_at,omitempty"`
	Status                            NodeStatus          `json:"status" bson:"status"`
	Mutex                             *sync.Mutex         `json:"-"`
}

type ExtClientRecord struct {
	Key       string `gorm:"primaryKey"`
	TenantID  string `gorm:"default:''"`
	NetworkID string
	Value     datatypes.JSONType[ExtClient]
}

type Host struct {
	ID                 uuid.UUID `gorm:"primaryKey" json:"id" yaml:"id"`
	TenantID           string    `gorm:"default:'';index" json:"tenant_id"`
	Verbosity          int       `json:"verbosity" yaml:"verbosity"`
	FirewallInUse      string    `json:"firewallinuse" yaml:"firewallinuse"`
	Version            string    `json:"version" yaml:"version"`
	IPForwarding       bool      `json:"ipforwarding" yaml:"ipforwarding"`
	DaemonInstalled    bool      `json:"daemoninstalled" yaml:"daemoninstalled"`
	AutoUpdate         bool      `json:"autoupdate" yaml:"autoupdate"`
	HostPass           string    `json:"hostpass" yaml:"hostpass"`
	Name               string    `json:"name" yaml:"name"`
	OS                 string    `json:"os" yaml:"os"`
	OSFamily           string    `json:"os_family" yaml:"os_family"`
	OSVersion          string    `json:"os_version" yaml:"os_version"`
	KernelVersion      string    `json:"kernel_version" yaml:"kernel_version"`
	Interface          string    `json:"interface" yaml:"interface"`
	Debug              bool      `json:"debug" yaml:"debug"`
	ListenPort         int       `json:"listenport" yaml:"listenport"`
	WgPublicListenPort int       `json:"wg_public_listen_port" yaml:"wg_public_listen_port"`
	// TcpProxyEnabled: host accepts TCP/WSS framed WG uplinks (gateway listen is host-level).
	TcpProxyEnabled bool `json:"tcp_proxy_enabled" yaml:"tcp_proxy_enabled"`
	// TcpProxyListenPort: listen port when TcpProxyEnabled (default 443 if enabled with port 0).
	TcpProxyListenPort int `json:"tcp_proxy_listen_port" yaml:"tcp_proxy_listen_port"`
	// TcpProxyTLSMode: selfsigned (default) or proxy. Empty means selfsigned.
	TcpProxyTLSMode string `json:"tcp_proxy_tls_mode" yaml:"tcp_proxy_tls_mode"`
	// TcpProxyListenAddr: optional bind address (e.g. 127.0.0.1). Empty means all interfaces (:port).
	TcpProxyListenAddr string `json:"tcp_proxy_listen_addr,omitempty" yaml:"tcp_proxy_listen_addr,omitempty"`
	// TcpProxyPublicHostname: public DNS name clients dial when TLS mode is proxy
	// (e.g. gateway.example.com). Empty falls back to EndpointIP.
	TcpProxyPublicHostname string `json:"tcp_proxy_public_hostname,omitempty" yaml:"tcp_proxy_public_hostname,omitempty"`
	// TcpProxyCertFingerprint: SHA-256 hex of the leaf cert when tls mode is selfsigned.
	TcpProxyCertFingerprint string                      `json:"tcp_proxy_cert_fingerprint,omitempty" yaml:"tcp_proxy_cert_fingerprint,omitempty"`
	MTU                     int                         `json:"mtu" yaml:"mtu"`
	PublicKey               WgKey                       `json:"publickey" yaml:"publickey"`
	MacAddress              net.HardwareAddr            `json:"macaddress" yaml:"macaddress"`
	TrafficKeyPublic        datatypes.JSONSlice[byte]   `json:"traffickeypublic" yaml:"traffickeypublic"`
	Nodes                   datatypes.JSONSlice[string] `json:"nodes" yaml:"nodes"`
	Interfaces              datatypes.JSONSlice[Iface]  `json:"interfaces" yaml:"interfaces"`
	DefaultInterface        string                      `json:"defaultinterface" yaml:"defaultinterface"`
	EndpointIP              net.IP                      `json:"endpointip" yaml:"endpointip"`
	EndpointIPv6            net.IP                      `json:"endpointipv6" yaml:"endpointipv6"`
	IsDocker                bool                        `json:"isdocker" yaml:"isdocker"`
	IsK8S                   bool                        `json:"isk8s" yaml:"isk8s"`
	IsStaticPort            bool                        `json:"isstaticport" yaml:"isstaticport"`
	IsStatic                bool                        `json:"isstatic" yaml:"isstatic"`
	IsDefault               bool                        `json:"isdefault" yaml:"isdefault"`
	DNS                     string                      `json:"dns_status" yaml:"dns_status"`
	NatType                 string                      `json:"nat_type,omitempty" yaml:"nat_type,omitempty"`
	TurnEndpoint            *AddrPort                   `json:"turn_endpoint,omitempty" yaml:"turn_endpoint,omitempty"`
	PersistentKeepalive     time.Duration               `json:"persistentkeepalive" swaggertype:"primitive,integer" format:"int64" yaml:"persistentkeepalive"`
	Location                string                      `json:"location" yaml:"location"` // Format: "lat,lon"
	CountryCode             string                      `json:"country_code" yaml:"country_code"`
	EnableFlowLogs          bool                        `json:"enable_flow_logs" yaml:"enable_flow_logs"`

	// MDM device-matching identifiers. Reported by netclient on host check-in
	// and consumed by the MDM sync worker to match a Netmaker host to its
	// upstream MDM-managed device record.
	EntraDeviceID string `json:"entra_device_id" yaml:"entra_device_id"`
	SerialNumber  string `json:"serial_number"   yaml:"serial_number"`
	HardwareUUID  string `json:"hardware_uuid"   yaml:"hardware_uuid"`

	// OwnerUsername is the Netmaker user who registered this device (desktop/netclient).
	OwnerUsername string `json:"owner_username" yaml:"owner_username"`

	CreatedAt time.Time `json:"created_at" yaml:"created_at"`
	UpdatedAt time.Time `json:"updated_at" yaml:"updated_at"`
}

type Iface struct {
	Name          string    `json:"name"`
	Address       net.IPNet `json:"address"`
	AddressString string    `json:"addressString"`
}

type Integration struct {
	ID        string         `gorm:"primaryKey" json:"id"`
	Provider  string         `gorm:"default:'';uniqueIndex:idx_integrations_provider_tenant" json:"provider"`
	TenantID  string         `gorm:"default:'';uniqueIndex:idx_integrations_provider_tenant" json:"tenant_id"`
	Type      string         `gorm:"not null" json:"type"`
	Config    datatypes.JSON `gorm:"not null" json:"config"`
	CreatedAt time.Time      `json:"created_at"`
	UpdatedAt time.Time      `json:"updated_at"`
}

type Internal struct {
	Key      string `gorm:"primaryKey"`
	TenantID string `gorm:"default:'';index"`
	Value    string `gorm:"not null"`
}

type JITGrant struct {
	ID        string    `gorm:"primaryKey" json:"id"`
	TenantID  string    `gorm:"default:'';index" json:"tenant_id"`
	NetworkID string    `gorm:"network_id" json:"network_id"`
	UserID    string    `gorm:"user_id" json:"user_id"`
	RequestID string    `gorm:"request_id" json:"request_id"`
	GrantedAt time.Time `gorm:"granted_at" json:"granted_at"`
	ExpiresAt time.Time `gorm:"expires_at" json:"expires_at"`
}

type JITRequest struct {
	ID            string    `gorm:"primaryKey" json:"id"`
	TenantID      string    `gorm:"default:'';index" json:"tenant_id"`
	NetworkID     string    `gorm:"network_id" json:"network_id"`
	UserID        string    `gorm:"user_id" json:"user_id"`
	UserName      string    `gorm:"user_name" json:"user_name"`
	Reason        string    `gorm:"reason" json:"reason"`
	Status        string    `gorm:"status" json:"status"` // pending, approved, denied, expired
	RevokedAt     time.Time `gorm:"revoked_at" json:"revoked_at"`
	RequestedAt   time.Time `gorm:"requested_at" json:"requested_at"`
	ApprovedAt    time.Time `gorm:"approved_at" json:"approved_at,omitempty"`
	ApprovedBy    string    `gorm:"approved_by" json:"approved_by,omitempty"`
	DurationHours int       `gorm:"duration_hours" json:"duration_hours,omitempty"`
	ExpiresAt     time.Time `gorm:"expires_at" json:"expires_at,omitempty"`
}

type Job struct {
	ID        string `gorm:"primaryKey"`
	CreatedAt time.Time
}

type Metric struct {
	NodeName          string        `json:"node_name" bson:"node_name" yaml:"node_name"`
	Uptime            int64         `json:"uptime" bson:"uptime" yaml:"uptime" swaggertype:"primitive,integer" format:"int64"`
	TotalTime         int64         `json:"totaltime" bson:"totaltime" yaml:"totaltime" swaggertype:"primitive,integer" format:"int64"`
	Latency           int64         `json:"latency" bson:"latency" yaml:"latency" swaggertype:"primitive,integer" format:"int64"`
	TotalReceived     int64         `json:"totalreceived" bson:"totalreceived" yaml:"totalreceived" swaggertype:"primitive,integer" format:"int64"`
	LastTotalReceived int64         `json:"lasttotalreceived" bson:"lasttotalreceived" yaml:"lasttotalreceived" swaggertype:"primitive,integer" format:"int64"`
	TotalSent         int64         `json:"totalsent" bson:"totalsent" yaml:"totalsent" swaggertype:"primitive,integer" format:"int64"`
	LastTotalSent     int64         `json:"lasttotalsent" bson:"lasttotalsent" yaml:"lasttotalsent" swaggertype:"primitive,integer" format:"int64"`
	ActualUptime      time.Duration `json:"actualuptime" swaggertype:"primitive,integer" format:"int64" bson:"actualuptime" yaml:"actualuptime"`
	PercentUp         float64       `json:"percentup" bson:"percentup" yaml:"percentup"`
	Connected         bool          `json:"connected" bson:"connected" yaml:"connected"`
}

type Metrics struct {
	Network      string            `json:"network" bson:"network" yaml:"network"`
	NodeID       string            `json:"node_id" bson:"node_id" yaml:"node_id"`
	NodeName     string            `json:"node_name" bson:"node_name" yaml:"node_name"`
	Connectivity map[string]Metric `json:"connectivity" bson:"connectivity" yaml:"connectivity"`
	UpdatedAt    time.Time         `json:"updated_at" bson:"updated_at" yaml:"updated_at"`
}

type MetricsRecord struct {
	Key       string `gorm:"primaryKey"`
	TenantID  string `gorm:"default:'';index"`
	NetworkID string
	Value     datatypes.JSONType[Metrics]
}

type Nameserver struct {
	ID          string                                `gorm:"primaryKey" json:"id"`
	TenantID    string                                `gorm:"default:'';index" json:"tenant_id"`
	Name        string                                `gorm:"name" json:"name"`
	NetworkID   string                                `gorm:"network_id" json:"network_id"`
	Description string                                `gorm:"description" json:"description"`
	Default     bool                                  `gorm:"column:default" json:"default"`
	Fallback    bool                                  `gorm:"fallback" json:"fallback"`
	Servers     datatypes.JSONSlice[string]           `gorm:"servers" json:"servers"`
	MatchAll    bool                                  `gorm:"match_all" json:"match_all"`
	Domains     datatypes.JSONSlice[NameserverDomain] `gorm:"domains" json:"domains"`
	// TODO: deprecate
	MatchDomains datatypes.JSONSlice[string] `gorm:"match_domains" json:"match_domains"`
	Tags         datatypes.JSONMap           `gorm:"tags" json:"tags"`
	Nodes        datatypes.JSONMap           `gorm:"nodes" json:"nodes"`
	Status       bool                        `gorm:"status" json:"status"`
	CreatedBy    string                      `gorm:"created_by" json:"created_by"`
	CreatedAt    time.Time                   `gorm:"created_at" json:"created_at"`
	UpdatedAt    time.Time                   `gorm:"updated_at" json:"updated_at"`
}

type NameserverDomain struct {
	Domain         string `json:"domain"`
	IsSearchDomain bool   `json:"is_search_domain"`
	IsADDomain     bool   `json:"is_ad_domain"`
}

type Network struct {
	ID            string `gorm:"primaryKey" json:"id"`
	TenantID      string `gorm:"default:'';uniqueIndex:udx_network_tenant_name" json:"tenant_id"`
	Name          string `gorm:"uniqueIndex:udx_network_tenant_name" json:"netid"`
	AddressRange  string `json:"addressrange"`
	AddressRange6 string `json:"addressrange6"`
	// in seconds.
	DefaultKeepAlive int                         `gorm:"default:20" json:"defaultkeepalive"`
	DefaultMTU       int32                       `gorm:"default:1280" json:"defaultmtu"`
	AutoJoin         bool                        `json:"auto_join"`
	AutoRemove       bool                        `json:"auto_remove"`
	AutoRemoveTags   datatypes.JSONSlice[string] `json:"auto_remove_tags"`
	// in minutes
	AutoRemoveThreshold         int                              `json:"auto_remove_threshold"`
	JITEnabled                  bool                             `json:"jit_enabled"`
	JITUserGroupIDs             datatypes.JSONSlice[UserGroupID] `json:"jit_user_group_ids"`
	VirtualNATPoolIPv4          string                           `json:"virtual_nat_pool_ipv4"`
	VirtualNATSitePrefixLenIPv4 int                              `json:"virtual_nat_site_prefixlen_ipv4"`
	NodesUpdatedAt              time.Time                        `json:"nodes_updated_at"`
	CreatedBy                   string                           `json:"created_by"`
	CreatedAt                   time.Time                        `json:"created_at"`
	UpdatedAt                   time.Time                        `json:"updated_at"`
}

type NetworkID string

type NetworkRoles map[NetworkID]map[UserRoleID]struct{}

type Node struct {
	ID                         string                      `gorm:"primaryKey" json:"id"`
	TenantID                   string                      `gorm:"default:'';index" json:"tenant_id"`
	HostID                     string                      `gorm:"not null;index" json:"host_id"`
	Host                       *Host                       `gorm:"foreignKey:HostID;constraint:OnDelete:CASCADE" json:"host,omitempty"`
	NetworkID                  string                      `gorm:"not null;index" json:"network_id"`
	Network                    *Network                    `gorm:"foreignKey:NetworkID;constraint:OnDelete:CASCADE" json:"network,omitempty"`
	Address                    string                      `json:"address"`
	Address6                   string                      `json:"address6"`
	Connected                  bool                        `json:"connected"`
	Action                     string                      `json:"action"`
	Status                     NodeStatus                  `json:"status"`
	PendingDelete              bool                        `json:"pending_delete"`
	AutoAssignGateway          bool                        `json:"auto_assign_gateway"`
	IsGateway                  bool                        `json:"is_gateway"`
	IsAutoRelay                string                      `json:"is_auto_relay"`
	IsInternetGateway          bool                        `json:"is_internet_gateway"`
	AdditionalGatewayEndpoints datatypes.JSONSlice[string] `json:"additional_gateway_endpoints"`
	RelayedClients             datatypes.JSONMap           `json:"relayed_clients"`
	RelayedIGWClients          datatypes.JSONMap           `json:"relayed_igw_clients"`
	RelayedByNodeID            *string                     `json:"relayed_by_node_id"`
	IsIGWClient                bool                        `json:"is_igw_client"`
	// UseTcpUplink: assigned/relayed node opts into TCP uplink to its gateway (requires host TcpProxyEnabled).
	UseTcpUplink bool `json:"use_tcp_uplink"`
	// SelectedInternetEgressID is the internet-type egress this node uses as its exit node (empty = none).
	SelectedInternetEgressID          string                                `json:"selected_internet_egress_id"`
	AutoRelayedPeers                  datatypes.JSONType[map[string]string] `json:"auto_relayed_peers"`
	Tags                              datatypes.JSONMap                     `json:"tags"`
	PostureCheckSeverity              Severity                              `json:"posture_check_severity"`
	PostureCheckLastEvaluationCycleID string                                `json:"posture_check_last_evaluation_cycle_id"`
	PostureCheckLastEvaluatedAt       time.Time                             `json:"posture_check_last_evaluated_at"`
	Metadata                          string                                `json:"metadata"`
	LastCheckIn                       time.Time                             `json:"last_check_in"`
	ExpirationDateTime                time.Time                             `json:"expiration_date_time"`
	CreatedAt                         time.Time                             `json:"created_at"`
	UpdatedAt                         time.Time                             `json:"updated_at"`
}

type NodeStatus string

type OrgMembership struct {
	OrganizationID             string     `gorm:"primaryKey" json:"organization_id"`
	UserID                     string     `gorm:"primaryKey" json:"user_id"`
	RoleID                     UserRoleID `json:"role_id"`
	AuthType                   AuthType   `json:"auth_type"`
	ExternalIdentityProviderID string     `json:"external_identity_provider_id"`
	Password                   string     `json:"password"`
	AccountDisabled            bool       `json:"account_disabled"`
	IsMFAEnabled               bool       `json:"is_mfa_enabled"`
	TOTPSecret                 string     `json:"totp_secret"`
}

type Organization struct {
	ID        string    `gorm:"primaryKey"         json:"id"`
	Name      string    `gorm:"not null"           json:"name"`
	Slug      string    `gorm:"uniqueIndex;not null" json:"slug"`
	Metadata  string    `json:"metadata"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type OrganizationSettings struct {
	ID       string `gorm:"primaryKey"`
	Settings datatypes.JSONType[OrganizationSettingsData]
}

type OrganizationSettingsData struct {
	AuthProvider                   string `json:"auth_provider"`
	ClientID                       string `json:"client_id"`
	ClientSecret                   string `json:"client_secret"`
	OIDCIssuer                     string `json:"oidc_issuer"`
	AzureTenant                    string `json:"azure_tenant"`
	EmailSenderAddr                string `json:"email_sender_addr"`
	EmailSenderUser                string `json:"email_sender_user"`
	EmailSenderPassword            string `json:"email_sender_password"`
	SmtpHost                       string `json:"smtp_host"`
	SmtpPort                       int    `json:"smtp_port"`
	SmtpSkipTlsVerify              bool   `json:"smtp_skip_tls_verify"`
	AuditLogsRetentionPeriodInDays int    `json:"audit_logs_retention_period"`
}

type Origin string

type PendingHost struct {
	ID            string         `gorm:"id" json:"id"`
	TenantID      string         `gorm:"default:'';index" json:"tenant_id"`
	HostID        string         `gorm:"host_id" json:"host_id"`
	Hostname      string         `gorm:"host_name" json:"host_name"`
	Network       string         `gorm:"network" json:"network"`
	PublicKey     string         `gorm:"public_key" json:"public_key"`
	EnrollmentKey datatypes.JSON `gorm:"enrollment_key_id" json:"enrollment_key_id"`
	OS            string         `gorm:"os" json:"os"`
	Version       string         `gorm:"version" json:"version"`
	Location      string         `gorm:"location" json:"location"` // Format: "lat,lon"
	RequestedAt   time.Time      `gorm:"requested_at" json:"requested_at"`
}

type PendingUser struct {
	ID                         string      `gorm:"primaryKey" json:"id"`
	Scope                      scope.Scope `gorm:"default:0;uniqueIndex:udx_pending_user_scope_username" json:"scope"`
	ScopeID                    string      `gorm:"default:'';uniqueIndex:udx_pending_user_scope_username" json:"scope_id"`
	Username                   string      `gorm:"uniqueIndex:udx_pending_user_scope_username" json:"username"`
	ExternalIdentityProviderID string      `json:"external_identity_provider_id"`
	CreatedAt                  time.Time   `json:"created_at"`
}

type PostureCheck struct {
	ID          string                      `gorm:"primaryKey" json:"id"`
	TenantID    string                      `gorm:"default:'';index" json:"tenant_id"`
	Name        string                      `gorm:"name" json:"name"`
	NetworkID   NetworkID                   `gorm:"network_id" json:"network_id"`
	Description string                      `gorm:"description" json:"description"`
	Attribute   Attribute                   `gorm:"attribute" json:"attribute"`
	Values      datatypes.JSONSlice[string] `gorm:"values" json:"values"`
	// Config holds attribute-specific structured options. Used by MDMCompliance
	// for {require_enrolled, require_compliant, max_state_age_hours}; null for
	// legacy attributes that rely on Values.
	Config     datatypes.JSONMap `gorm:"config" json:"config"`
	Severity   Severity          `gorm:"severity" json:"severity"`
	Tags       datatypes.JSONMap `gorm:"tags" json:"tags"`
	UserGroups datatypes.JSONMap `gorm:"user_groups" json:"user_groups"`
	Status     bool              `gorm:"status" json:"status"`
	CreatedBy  string            `gorm:"created_by" json:"created_by"`
	CreatedAt  time.Time         `gorm:"created_at" json:"created_at"`
	UpdatedAt  time.Time         `gorm:"updated_at" json:"updated_at"`
}

type PostureCheckViolation struct {
	EvaluationCycleID string    `gorm:"primaryKey;column:evaluation_cycle_id" json:"evaluation_cycle_id"`
	TenantID          string    `gorm:"default:'';index" json:"tenant_id"`
	CheckID           string    `gorm:"primaryKey;column:check_id" json:"check_id"`
	NodeID            string    `gorm:"primaryKey;column:node_id" json:"node_id"`
	Name              string    `json:"name"`
	Attribute         string    `json:"attribute"`
	Message           string    `json:"message"`
	Severity          Severity  `json:"severity"`
	EvaluatedAt       time.Time `json:"evaluated_at"`
}

type Protocol string

type ResourceAccess map[RsrcType]map[RsrcID]RsrcPermissionScope

type RsrcID string

type RsrcPermissionScope struct {
	Create    bool `json:"create"`
	Read      bool `json:"read"`
	Update    bool `json:"update"`
	Delete    bool `json:"delete"`
	VPNaccess bool `json:"vpn_access"`
	SelfOnly  bool `json:"self_only"`
}

type RsrcType string

type Severity int

type SsoState struct {
	Scope      scope.Scope `json:"scope"`
	ScopeID    string      `json:"scope_id"`
	AppName    string      `json:"app_name"`
	Value      string      `json:"value"`
	Expiration time.Time   `json:"expiration"`
}

type SsoStateRecord struct {
	Key   string `gorm:"primaryKey"`
	Value datatypes.JSONType[SsoState]
}

type SubjectType string

type Tag struct {
	ID        TagID     `json:"id"`
	TagName   string    `json:"tag_name"`
	Network   NetworkID `json:"network"`
	ColorCode string    `json:"color_code"`
	CreatedBy string    `json:"created_by"`
	CreatedAt time.Time `json:"created_at"`
}

type TagID string

type TagRecord struct {
	Key       string `gorm:"primaryKey"`
	TenantID  string `gorm:"default:'';index"`
	NetworkID string
	Value     datatypes.JSONType[Tag]
}

type Tenant struct {
	ID             string    `gorm:"primaryKey"           json:"id"`
	Name           string    `gorm:"not null"             json:"name"`
	Slug           string    `gorm:"uniqueIndex;not null" json:"slug"`
	OrganizationID string    `gorm:"not null;index"       json:"organization_id"`
	Metadata       string    `json:"metadata"`
	CreatedAt      time.Time `json:"created_at"`
	UpdatedAt      time.Time `json:"updated_at"`
}

type TenantMembership struct {
	TenantID                   string                                       `gorm:"primaryKey" json:"tenant_id"`
	UserID                     string                                       `gorm:"primaryKey" json:"user_id"`
	RoleID                     UserRoleID                                   `json:"role_id"`
	Groups                     datatypes.JSONType[map[UserGroupID]struct{}] `json:"groups"`
	AuthType                   AuthType                                     `json:"auth_type"`
	ExternalIdentityProviderID string                                       `json:"external_identity_provider_id"`
	Password                   string                                       `json:"password"`
	AccountDisabled            bool                                         `json:"account_disabled"`
	IsMFAEnabled               bool                                         `json:"is_mfa_enabled"`
	TOTPSecret                 string                                       `json:"totp_secret"`
}

type TenantSettings struct {
	NetclientAutoUpdate         bool     `json:"netclientautoupdate"`
	Verbosity                   int32    `json:"verbosity"`
	AuthProvider                string   `json:"authprovider"`
	OIDCIssuer                  string   `json:"oidcissuer"`
	ClientID                    string   `json:"client_id"`
	ClientSecret                string   `json:"client_secret"`
	SyncEnabled                 bool     `json:"sync_enabled"`
	GoogleAdminEmail            string   `json:"google_admin_email"`
	GoogleSACredsJson           string   `json:"google_sa_creds_json"`
	AzureTenant                 string   `json:"azure_tenant"`
	OktaOrgURL                  string   `json:"okta_org_url"`
	OktaAPIToken                string   `json:"okta_api_token"`
	UserFilters                 []string `json:"user_filters"`
	GroupFilters                []string `json:"group_filters"`
	IDPSyncInterval             string   `json:"idp_sync_interval"`
	Telemetry                   string   `json:"telemetry"`
	BasicAuth                   bool     `json:"basic_auth"`
	JwtValidityDuration         int      `json:"jwt_validity_duration"`
	JwtValidityDurationClients  int      `json:"jwt_validity_duration_clients"`
	MFAEnforced                 bool     `json:"mfa_enforced"`
	RacRestrictToSingleNetwork  bool     `json:"rac_restrict_to_single_network"`
	EndpointDetection           bool     `json:"endpoint_detection"`
	AllowedEmailDomains         string   `json:"allowed_email_domains"`
	MetricInterval              string   `json:"metric_interval"`
	MetricsPort                 int      `json:"metrics_port"`
	IPDetectionInterval         int      `json:"ip_detection_interval"`
	ManageDNS                   bool     `json:"manage_dns"`
	DefaultDomain               string   `json:"default_domain"`
	Stun                        bool     `json:"stun"`
	StunServers                 string   `json:"stun_servers"`
	PeerConnectionCheckInterval string   `json:"peer_connection_check_interval"`
	PostureCheckInterval        string   `json:"posture_check_interval"`
	CleanUpInterval             int      `json:"clean_up_interval_in_mins"`
	EnableFlowLogs              bool     `json:"enable_flow_logs"`
	// AuditLogsRetentionPeriodInDays and the Smtp/EmailSender fields below are
	// not persisted here: they live on OrganizationSettings and are
	// populated/written through logic.GetServerSettings and
	// logic.UpsertServerSettings for API backward compatibility.
	AuditLogsRetentionPeriodInDays int    `json:"audit_logs_retention_period"`
	EmailSenderAddr                string `json:"email_sender_addr"`
	EmailSenderUser                string `json:"email_sender_user"`
	EmailSenderPassword            string `json:"email_sender_password"`
	SmtpHost                       string `json:"smtp_host"`
	SmtpPort                       int    `json:"smtp_port"`
	SmtpSkipTlsVerify              bool   `json:"smtp_skip_tls_verify"`
}

type TenantSettingsRecord struct {
	Key   string `gorm:"primaryKey"`
	Value datatypes.JSONType[TenantSettings]
}

type Theme string

type User struct {
	ID                         string     `gorm:"primaryKey" json:"id"`
	Username                   string     `gorm:"unique" json:"username"`
	DisplayName                string     `json:"display_name"`
	PlatformRoleID             UserRoleID `gorm:"-" json:"platform_role_id,omitempty"`
	ExternalIdentityProviderID string     `gorm:"-" json:"external_identity_provider_id"`
	AccountDisabled            bool       `gorm:"-" json:"account_disabled"`
	AuthType                   AuthType   `gorm:"-" json:"auth_type"`
	Password                   string     `gorm:"-" json:"password"`
	IsMFAEnabled               bool       `gorm:"-" json:"is_mfa_enabled"`
	TOTPSecret                 string     `gorm:"-" json:"totp_secret"`
	EmailValidated             bool       `json:"email_validated"`
	// NOTE: json tag is different from field name to ensure compatibility with the older model.
	LastLoginAt time.Time `json:"last_login_time"`
	// NOTE: json tag is different from field name to ensure compatibility with the older model.
	UserGroups    datatypes.JSONType[map[UserGroupID]struct{}] `gorm:"-" json:"user_group_ids,omitempty"`
	Theme         Theme                                        `json:"theme"`
	TextSize      string                                       `json:"text_size"`
	ReducedMotion bool                                         `json:"reduced_motion"`
	CreatedBy     string                                       `json:"created_by"`
	CreatedAt     time.Time                                    `json:"created_at"`
	UpdatedAt     time.Time                                    `json:"updated_at"`
}

type UserAccessToken struct {
	ID        string    `gorm:"primaryKey" json:"id"`
	TenantID  string    `gorm:"default:'';index" json:"tenant_id"`
	Name      string    `json:"name"`
	UserName  string    `json:"user_name"`
	ExpiresAt time.Time `json:"expires_at"`
	LastUsed  time.Time `json:"last_used"`
	CreatedBy string    `json:"created_by"`
	CreatedAt time.Time `json:"created_at"`
}